Privacy Policy

Last updated: October 4, 2026  ·  Effective: October 4, 2026

ConvoSurge ("we", "our", "us") is a product of Rockshaft Media. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at convosurge.com.

1. Information We Collect

• Account data: Name, email address, password (hashed), and role when you register.
• Business data: Facebook Page tokens, Instagram Business account IDs, and WhatsApp Business credentials you connect via OAuth.
• Conversation data: Messages exchanged between your business and end-users on connected platforms.
• Usage data: Log data, IP addresses, browser type, pages visited, and time spent on features.
• Payment data: Billing information processed by third-party payment processors (Razorpay). We do not store raw card numbers.

2. How We Use Your Information

• To provide, operate, and maintain the ConvoSurge platform.
• To process and route messages on your behalf via connected channels.
• To send transactional emails (verification, password reset, billing).
• To analyse usage patterns and improve platform performance.
• To comply with legal obligations and enforce our Terms of Service.

3. Data Sharing

We do not sell your personal data. We share data only with:

• Meta Platforms: To send/receive messages on Instagram, Facebook, and WhatsApp on your behalf.
• Supabase: Our database and authentication provider.
• OpenAI: For AI-generated responses (message content is sent to OpenAI API).
• Resend: For transactional email delivery.
• Redis Cloud: For queue and session management.

4. Data Retention

We retain conversation data for as long as your account is active. Upon account deletion, personal data is deleted within 30 days. Anonymised analytics data may be retained indefinitely.

5. Security

Access tokens are encrypted using AES-256-CBC before storage. All connections use HTTPS/TLS. We implement rate limiting and anomaly detection on all API endpoints.

6. Your Rights

You have the right to access, rectify, or delete your personal data. Submit requests to business@rockshaft.org. We will respond within 30 days.

How to delete your data (including Instagram, Facebook and WhatsApp data)

1. In ConvoSurge, open Integrations and click Disconnect on the account. ConvoSurge stops receiving and sending messages for it immediately.
2. Optionally, remove ConvoSurge from Instagram: Settings and activity → Website permissions → Apps and websites → ConvoSurge → Remove.
3. Email business@rockshaft.org from your account email with the subject “Data deletion request”. We delete the stored access tokens, connected account details and conversation history within 30 days and confirm by email.

7. Users in the EU, EEA and UK (GDPR and UK GDPR)

If you are in the European Economic Area or the United Kingdom, the following applies in addition to the rest of this policy.

• Who is responsible: Rockshaft Media is the controller for your account, usage and billing data. For the messages your customers send to your business, you (the business) are the controller and we act as your processor, handling those messages only on your instructions to reply, route and report on them.
• Lawful bases: performing our contract with you (running the platform), our legitimate interests (security, fraud prevention and improving the service), consent where the law requires it (for example, broadcast messages to customers who opted in), and legal obligations.
• Your rights: you can ask to access, correct, delete, restrict or port your personal data, object to processing based on legitimate interests, and withdraw consent at any time. You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office (ico.org.uk).
• International transfers: some of the providers listed in section 3 process data outside the EEA and UK. Where they do, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
• How to make a request: email business@rockshaft.org. We reply within one month. If you are a customer of a business that uses ConvoSurge, please contact that business first; we will help them respond.

8. California residents (CCPA/CPRA)

If you live in California, you have these rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

• What we collect: identifiers (name, email, IP address), commercial information (billing records), internet activity (usage and log data), and the content of messages processed for your business, as described in section 1. We collect it for the purposes in section 2.
• No sale or sharing: we do not sell personal information, and we do not share it for cross-context behavioural advertising.
• Your rights: you can ask to know what personal information we hold about you, to delete it and to correct it. We will not treat you differently for using these rights.
• How to make a request: email business@rockshaft.org. We will verify your request before acting on it, and an authorised agent may make a request for you.

9. Cookies

We use session cookies for authentication. No third-party advertising cookies are used.

10. Children's Privacy

ConvoSurge is not directed at children under 13. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this policy periodically. We will notify registered users via email of material changes.

12. Contact

Questions? Email us at business@rockshaft.org